CVE-2024-11696

What it actually does

Unhandled exceptions from loadManifestFromFile during add-on signature verification can disrupt the validation flow, allowing signature enforcement to be bypassed for unrelated add-ons and permitting installation of extensions whose manifests are invalid or unsupported.

Why it matters to the business

Organizations may unknowingly run tampered or malicious browser extensions that evade integrity checks, increasing risk of data theft, credential compromise, or unauthorized code execution across user systems.

How an attack unfolds

An attacker crafts an extension with an invalid or unsupported manifest, triggers the loadManifestFromFile exception during signature verification, and causes the validation process to fail for other extensions, resulting in acceptance of unsigned or altered add-ons that can then access browser APIs and user data.

How to fix it

Upgrade affected products to the fixed versions provided for each package (e.g., webkit2gtk on Ubuntu 16.04 LTS to 2.12.5-0ubuntu0.16.04.1 or later equivalent releases for Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5).

How to confirm the fix worked

Verify that installed browser and mail client versions meet or exceed the fixed releases, re-test add-on installation with deliberately invalid manifests to confirm signature enforcement is no longer bypassed, and review extension signing logs for successful validation entries.

Typical attack path

1. Prepare a malicious or modified extension containing an invalid manifest
2. Trigger the add-on installation or update path that invokes loadManifestFromFile
3. Cause an unhandled exception to bypass signature checks for unrelated extensions
4. Install the tampered extension and abuse granted permissions

How to detect it

Review browser and mail client logs for signature verification errors or unexpected manifest parsing exceptions around extension installation events; correlate with installation of extensions that were not previously present.

What your security team should do

• Immediately apply the listed fixed versions to all affected Firefox, ESR, Thunderbird, and webkit2gtk deployments
• Audit installed extensions for unexpected or unsigned add-ons
• Monitor for future signature-verification bypass reports in the same product family